CVE-2026-46716
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.
- CVSS 3.1
- 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-78, CWE-269, CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-99gv-2m7h-3hh9 | Go | github.com/nezhahq/nezha | >=1.4.0 <1.14.15-0.20260517022419-d7526351cf97 | 1.14.15-0.20260517022419-d7526351cf97 |
| GO-2026-5282 | Go | github.com/nezhahq/nezha | >=1.4.0 <1.14.15-0.20260517022419-d7526351cf97 | 1.14.15-0.20260517022419-d7526351cf97 |